HPE Aruba AOS CVE-2026-44871

Requires valid authenticated access to the CLI service reached via the PAPI protocol on an AOS-8 or AOS-10 controller - exploitation is NOT possible unauthenticated (CVSS PR:L confirms credentials are needed). The attack targets the command-line interface command handling, so the attacker must be able to reach the PAPI/CLI management interface over the network and submit input to it. Limiting factors: valid credentials are mandatory, the management plane (PAPI) must be network-reachable to the attacker, and only the listed version branches are affected (AOS 10.7.x ≤10.7.2.2, 10.8.0.0, 8.10.x ≤8.10.0.21, 8.13.x ≤8.13.1.1, 10.4.x ≤10.4.1.10, 8.12.x ≤8.12.0.6); the specific vulnerable CLI command/parameter is not described in the available sources.

Signals are moderate and largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw that nonetheless requires authentication (PR:L), so this is not a pre-auth remote code execution despite the 8.8 'High' base score. Exploitation signals are low: EPSS is only 0.07% (21st percentile), SSVC reports Exploitation: none and Automatable: no, and there is no CISA KEV listing and no public exploit identified at time of analysis - so there is no evidence of active or widespread exploitation. The counterweight is high technical impact: SSVC Technical Impact is 'total' and CVSS rates C:H/I:H/A:H, reflecting arbitrary OS command execution on the controller. The vuln.today priority is 'this_week' rather than act_now/emergency, which aligns with the low exploitation probability combined with severe impact and the requirement for valid credentials. Net: a genuine priority to patch on a normal cycle because the impact is complete and the affected platform is a network control plane, but not an emergency given the authentication precondition and absence of exploitation evidence. The main limiter - PR:L - is confirmed by the CVSS vector and matches the description's 'authenticated remote attacker', so the signals do not conflict.

An attacker who already holds valid (even low-privilege) CLI credentials connects to the AOS-8/AOS-10 CLI service exposed over the PAPI protocol and submits crafted input that is passed unsafely to the underlying shell, injecting OS commands (CWE-77). This yields arbitrary command execution on the controller's operating system. No public exploit code has been identified, and the specific injection point/parameter is not described in the available sources.